#!/usr/bin/env bash
# Tests provision_account_dir role stamping (Task 983): a fresh account is
# stamped with the passed role; a legacy account.json with no role is migrated.
set -uo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PLAT_SCRIPTS="$SCRIPT_DIR/.."
PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
TEMPLATES_DIR="$PROJECT_DIR/templates"
PASS=0; FAIL=0; FAILED=()
role_of() { python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('role',''))" "$1"; }
ms_of() { python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('managedService'))" "$1"; }
has_admins() { python3 -c "import json,sys; print('yes' if 'admins' in json.load(open(sys.argv[1])) else 'no')" "$1"; }
assert_eq() { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
assert_nonempty() { if [ -s "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected non-empty file [$1]"); fi; }

. "$PLAT_SCRIPTS/lib/provision-account-dir.sh"
export TEMPLATES_DIR PROJECT_DIR
export SCRIPT_DIR="$PLAT_SCRIPTS"
export USERS_FILE="/nonexistent/users.json"

# Fresh account -> role=house stamped
T1=$(mktemp -d); A1="$T1/acct-house"
OUT1="$(provision_account_dir "$A1" "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa" "house" 2>/dev/null)"
assert_eq "$(role_of "$A1/account.json")" "house" "fresh-house-role"
# Task 1938 — provision seeds the vertical's root domain buckets; the log line
# proves seed_domain_root_dirs ran (bucket set depends on the brand's vertical).
assert_eq "$(printf '%s' "$OUT1" | grep -c 'seeded-roots=')" "1" "fresh-seed-roots-logged"
assert_eq "$(ms_of "$A1/account.json")" "False" "fresh-managedService-default"
# Task 1483 — the WhatsApp passive requirement-intake identity is seeded, non-empty.
assert_nonempty "$A1/agents/passive/IDENTITY.md" "passive-identity-seeded"
# Task 1623 — the house account keeps admins[] (the install-wide access surface).
assert_eq "$(has_admins "$A1/account.json")" "yes" "house-keeps-admins"
rm -rf "$T1"

# Legacy account.json with NO role -> migrated to house
T2=$(mktemp -d); A2="$T2/acct-legacy"; mkdir -p "$A2"
printf '{"accountId":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb","tier":"solo","admins":[]}\n' > "$A2/account.json"
provision_account_dir "$A2" "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb" "house" >/dev/null 2>&1
assert_eq "$(role_of "$A2/account.json")" "house" "legacy-migrated-to-house"
rm -rf "$T2"

# Client account -> role=client
T3=$(mktemp -d); A3="$T3/acct-client"
provision_account_dir "$A3" "cccccccc-cccc-cccc-cccc-cccccccccccc" "client" >/dev/null 2>&1
assert_eq "$(role_of "$A3/account.json")" "client" "client-role"
# Task 1623 — a client sub-account carries no admins[] (retired: seats 999,
# inbound read 1596, field 1623). Access is install-wide.
assert_eq "$(has_admins "$A3/account.json")" "no" "client-no-admins"
rm -rf "$T3"

echo "PASS=$PASS FAIL=$FAIL"
if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi